CVE-2023-30584
published 2023-10-18CVE-2023-30584: A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the…
PriorityP338high7.7CVSS 3.1
AVLACLPRNUINSUCHIHAN
EPSS
0.38%
30.9th percentile
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | — | — |
| fedoraproject | fedora | — | — |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.* | 12.* |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.* | 14.* |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.* | 16.* |
| nodejs | node | >= 17.0 < 17.* | 17.* |
| nodejs | node | >= 19.0 < 19.* | 19.* |
| nodejs | node | >= 20.0 < 20.8.1 | 20.8.1 |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | node.js | >= 20.0.0 < 20.8.0 | 20.8.0 |
| nodejs | node.js | >= 20.0.0 < 20.8.1 | 20.8.1 |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
osv7.7HIGH
vendor_debian7.7LOW
vendor_redhat7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jpgc-8hrm-hvwj: A vulnerability has been discovered in Node
ghsa_unreviewed·2024-09-07
CVE-2023-30584 [HIGH] CWE-22 GHSA-jpgc-8hrm-hvwj: A vulnerability has been discovered in Node
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
OSV
CVE-2023-39331: A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6
osv·2023-10-18·CVSS 7.7
CVE-2023-39331 [HIGH] CVE-2023-39331: A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
GHSA
GHSA-9hm3-chgj-45rm: Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects
ghsa_unreviewed·2023-10-18·CVSS 7.7
CVE-2023-39332 [HIGH] CWE-22 GHSA-9hm3-chgj-45rm: Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.
This is distinct from CVE-2023-32004 ([report 2038134](https://hackerone.com/reports/2038134)), which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.
Impacts:
This vulnerability affects all users using the experimental permission model in Node.js 20.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
GHSA
GHSA-7xrv-q25v-f95m: A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6
ghsa_unreviewed·2023-10-18·CVSS 7.7
CVE-2023-39331 [HIGH] CWE-22 GHSA-7xrv-q25v-f95m: A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CISA ICS
Siemens SINEC INS
cisa_ics·2024-11-14
Siemens SINEC INS
ICS Advisory
##
Siemens SINEC INS
Release DateNovember 14, 2024
Alert CodeICSA-24-319-08
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.9
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerabilities: Improper Authentication, Out-of-bounds Write, Ineffici
CISA ICS
Siemens SINEC NMS
cisa_ics·2024-02-15
Siemens SINEC NMS
ICS Advisory
##
Siemens SINEC NMS
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-15
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC NMS
- Vulnerabilities: Out-of-bounds Read, Inadequate Encryption Strength, Double Free, Use After Free, NULL Pointer Dereference, Improper Input Validation, Missing Encryption of Sensitive Data, Allocation of Resources Wit
Red Hat
nodejs: permission model improperly protects against path traversal
vendor_redhat·2023-10-13·CVSS 7.7
CVE-2023-39331 [HIGH] CWE-22 nodejs: permission model improperly protects against path traversal
nodejs: permission model improperly protects against path traversal
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.
Package: nodejs:16/nodejs (Red Hat Enterprise Linux
Red Hat
nodejs: path traversal through path stored in Uint8Array
vendor_redhat·2023-10-13·CVSS 7.7
CVE-2023-39332 [HIGH] CWE-22 nodejs: path traversal through path stored in Uint8Array
nodejs: path traversal through path stored in Uint8Array
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.
This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer cl
Red Hat
nodejs: path traversal bypass in experimental permission model
vendor_redhat·2023-06-20·CVSS 7.7
CVE-2023-30584 [HIGH] CWE-22 nodejs: path traversal bypass in experimental permission model
nodejs: path traversal bypass in experimental permission model
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.
This vulnerability affects all users using the experimental permission model in Node.js
Statement: Red Hat does not ship Node.js 20.x in any version of RHEL.
Package: nodejs:14/nodejs (Red Hat Enterpri
Debian
CVE-2023-39332: nodejs - Various `node:fs` functions allow specifying paths as either strings or `Uint8Ar...
vendor_debian·2023·CVSS 7.7
CVE-2023-39332 [HIGH] CVE-2023-39332: nodejs - Various `node:fs` functions allow specifying paths as either strings or `Uint8Ar...
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects. This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Debian
CVE-2023-39331: nodejs - A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently...
vendor_debian·2023·CVSS 7.7
CVE-2023-39331 [HIGH] CVE-2023-39331: nodejs - A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently...
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Debian
CVE-2023-30584: nodejs - A vulnerability has been discovered in Node.js version 20, specifically within t...
vendor_debian·2023·CVSS 7.7
CVE-2023-30584 [HIGH] CVE-2023-30584: nodejs - A vulnerability has been discovered in Node.js version 20, specifically within t...
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
HackerOne
Path traversal by monkey-patching Buffer internals
hackerone·2024-05-29·CVSS 8.8
[HIGH] Path traversal by monkey-patching Buffer internals
Path traversal by monkey-patching Buffer internals
**Summary:** In Node.js 20 and Node.js 21, the permission model protects itself against path traversal attacks by calling `path.resolve()` on any paths given by the user. If the path is to be treated as a `Buffer`, the implementation uses `Buffer.from()` to obtain a `Buffer` from the result of `path.resolve()`. By monkey-patching `Buffer` internals, namely, `Buffer.prototype.utf8Write`, the application can modify the result of `path.resolve()`, which leads to a path traversal vulnerability.
**Description:** This vulnerability was introduced in [commit 1f64147e](https://github.com/nodejs/node/commit/1f64147eb607f82060e08884f993597774c69280), which itself was a patch of a path traversal vulnerability (see CVE-2023-32004, [report 2038134](h
HackerOne
Path traversal through path stored in Uint8Array in Node.js 20
hackerone·2024-01-20·CVSS 7.7
CVE-2023-30584 [HIGH] Path traversal through path stored in Uint8Array in Node.js 20
Path traversal through path stored in Uint8Array in Node.js 20
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.
This is distinct from CVE-2023-32004 ([report 2038134](https://hackerone.com/reports/2038134)), which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.
## Steps To Reproduce:
The following Node.js command prints the contents of `/etc/passwd` despite having been granted access to `/tmp` only. This relies on the fact that `
HackerOne
Permission model improperly protects against path traversal in Node.js 20
hackerone·2023-11-30·CVSS 7.7
CVE-2023-30584 [HIGH] Permission model improperly protects against path traversal in Node.js 20
Permission model improperly protects against path traversal in Node.js 20
**Summary:** A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit [205f1e6](https://github.com/nodejs/node/commit/205f1e643e25648173239b2de885fec430268492). The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.
**Description:** The function `possiblyTransformPath` calls `pathModule.resolve(path)`, where `pathModule` is the result of `require('path')`. Application code may replace the value of the `require('path').resolve`property with a user-defined function that does not resolve `/../` within any given path. Because `possiblyTransformPath`
2023-10-18
Published